# Licence register

Every third-party component, its licence, and whether it can ship inside a paid
binary. Step 0c of the build plan. A row marked UNKNOWN blocks the step that
needs the component, and no row is guessed.

Sources actually read, 16 August 2026: the licence files bundled inside each
installed wheel's dist-info, the LibRaw COPYRIGHT file and libraw.org licensing
statement, the rawpy README, and the YuNet model LICENSE file in opencv_zoo.
The setuptools 84.0.0 wheel's bundled `licenses/LICENSE` and
`License-Expression` metadata were read on 19 August 2026 before the guard
that makes build-system register coverage enforceable.

| Component | Version read | Licence | Can it ship inside a paid binary? |
|---|---|---|---|
| setuptools | 84.0.0 | MIT (wheel `licenses/LICENSE` and `License-Expression` metadata) | Not applicable. Build-system requirement only; if redistributed, retain the copyright and permission notice |
| numpy | 2.5.2 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 (wheel metadata). The wheel's `licenses/LICENSE.txt` also carries the notices for the binaries it bundles in `numpy.libs/` - OpenBLAS and LAPACK (BSD-3-Clause) and the GCC runtime library (GPL with the runtime library exception) - read 2026-08-22 | Yes. All permissive; retain licence texts in the distribution. SHIPPED: `packaging/licences/numpy/licenses/` (the wheel's full tree, 17 files) |
| pillow | 12.3.0 | MIT-CMU (wheel metadata) | Yes. Permissive; retain licence text. SHIPPED: `packaging/licences/pillow/LICENSE` |
| opencv-python-headless | 5.0.0.93 | Wheel metadata says Apache 2.0. The texts themselves, read 2026-08-22: `LICENSE.txt` is the MIT licence of the Python wrapper package (copyright Olli-Pekka Heinisuo); the OpenCV library in `cv2/` is Apache-2.0, the first text in `LICENSE-3RD-PARTY.txt`, followed by the licences of every library bundled into that binary | Yes. MIT and Apache-2.0 both permit commercial redistribution; ship both files with the binary. SHIPPED: `packaging/licences/opencv-python-headless/LICENSE.txt` and `packaging/licences/opencv-python-headless/LICENSE-3RD-PARTY.txt`. The FFmpeg the same wheel bundles has its own row below |
| FFmpeg (bundled inside the opencv-python-headless wheel as `cv2/opencv_videoio_ffmpeg500_64.dll` on Windows; the macOS wheel also bundles libbluray, libgnutls, libnettle, libhogweed, libintl, libmp3lame, libp11, librtmp, libsoxr and libtasn1) | as shipped in 5.0.0.93 | LGPL-2.1 per `LICENSE-3RD-PARTY.txt` ("FFmpeg is redistributed within all opencv-python packages ... This license applies to the above library binaries in the directory cv2/"), read 2026-08-22 | Yes, with the LGPL conditions: it is a separate shared library (onedir keeps it one; never onefile), the text ships in `LICENSE-3RD-PARTY.txt`, and the source must be offered. The source offer is NOT yet written - the wrapper project's FFmpeg build source has not been located and is not guessed here. Cherry never opens a video, so excluding the library from the bundle is the cleaner fix; both halves are owed (see HANDOFF v1.4) |
| Microsoft Visual C++ runtime DLLs (`numpy.libs/msvcp140-*.dll` inside the numpy wheel, `rawpy/vcomp140.dll` inside the rawpy wheel), Windows only | as shipped in numpy 2.5.2 and rawpy 0.27.0 | UNKNOWN. Microsoft's redistribution terms for these files have not been read; nothing in either wheel's licence texts names them | UNKNOWN. They are already inside every Windows build and the wheels ship them to everyone; the terms still have to be read and the row filled before this can be called settled (see HANDOFF v1.4) |
| YuNet face model (opencv_zoo face_detection_yunet) | 2020 model, licence read 2026-08-16 | MIT, copyright Shiqi Yu | Yes. MIT explicitly permits sale and sublicensing; retain copyright and licence notice |
| W3 defect-floor fixture `original.jpg` | SHA-256 `a4d154a877db23d7569e703912e0b9f5939e3fd26015cdafab2c9a582d53fa5e` | CC0-1.0. Clean derivative of Wikimedia Commons `Exterior - Haas-Lilienthal House - San Francisco, CA - DSC04917.JPG`; source record, URL, CC0 URL and fetched-source SHA-256 are in `corpus/MANIFEST.yaml` under `exterior-01`; per-file derivation is in `tests/fixtures/defect_floor/README.md` | Yes. CC0 permits copying, modification and commercial redistribution |
| W3 defect-floor fixture `noise.jpg` | SHA-256 `3c3d3f28ec8e5c94f67aa80370fd284fcc051bbd9fedcad3328f18c5f00f58dd` | CC0-1.0. Injected-noise derivative of the same `exterior-01` CC0 source, generated through `tools/corpus_variants.py` before the documented fixture resize/re-encode; source record is in `corpus/MANIFEST.yaml` and per-file derivation is in `tests/fixtures/defect_floor/README.md` | Yes. CC0 permits copying, modification and commercial redistribution |
| Install-pair assets (`packaging/onboarding/assets/`, 18 files) | approved 2026-08-21 | CC0-1.0 for every file. Each is either an unmodified Wikimedia Commons CC0 photograph or a single-axis derivative of one, produced by `tools/corpus_variants.py`. Per-file lineage - licence and source page for both sides of every pair - is carried in `packaging/onboarding/manifest.json` itself, which is what the loader validates; the source records are in `corpus/MANIFEST.yaml`. 9 source photographs in total | Yes. CC0 permits copying, modification and commercial redistribution. `tests/test_shipped_manifest.py` fails the build if any shipped file carries a licence outside the reviewed set |
| rawpy | 0.27.0 (bundles LibRaw 0.22.1) | MIT for rawpy itself (repo README + LICENSE). Wheels bundle LibRaw as a shared library under LICENSE.LibRaw; GPL demosaic packs are excluded from the wheels by the maintainer for exactly this reason | Yes for the MIT wrapper. The bundled LibRaw follows the LibRaw row below. SHIPPED: `packaging/licences/rawpy/LICENSE` |
| LibRaw (bundled inside rawpy wheels) | COPYRIGHT file read 2026-08-16 | Dual licence, licensee's choice: LGPL-2.1 or CDDL-1.0. The COPYRIGHT file and libraw.org name only these two arms; no separately sold commercial licence is mentioned on either, which corrects the build plan's assumption | Yes, with conditions, under either arm. LGPL-2.1: LibRaw must remain a separate, replaceable shared library (the rawpy wheel ships it as one, and PyInstaller onedir keeps it a separate file), the LibRaw source must be offered, and notices retained. CDDL-1.0: notices retained and source of the CDDL-covered files made available. Condition to hold in packaging (step 6): never statically fuse the LibRaw library into the executable, and ship the LibRaw licence text plus a source offer. SHIPPED 2026-08-22: `packaging/licences/libraw/LICENSE.LibRaw` (the LGPL-2.1 text the rawpy 0.27.0 wheel carries - no CDDL text is in the wheel) and `packaging/licences/libraw/SOURCE-OFFER.md` naming LibRaw 0.22.1 from `rawpy.libraw_version` and the upstream release URLs, each checked to resolve that day |
| Deck/app brand faces: Blauer Nue (7 weights), Rooftop family | files received 2026-08-22 in Ashrith's deck bundle; separate ZIPs inspected 2026-08-25 | Rooftop ZIP contains only `TRIAL_` faces and `Befonts-License.txt` states **Personal Use Only**. Blauer ZIP contains desktop/web font files and Webhance installation documentation, but no purchase receipt, EULA, or licence certificate; the documentation says use without a valid licence is prohibited | BLOCKED for source control and public/commercial builds. Neither family is bundled in the app; the exact Ash UI uses system fallbacks meanwhile. Owed: a commercial Rooftop licence covering app use/redistribution and proof of the Blauer licence scope, or approved substitutions |
| Deck brand face: Manrope (6 weights, `deck/fonts/Manrope-*.ttf`) | files received 2026-08-22 in Ashrith's deck bundle | UNKNOWN. No licence text was supplied with the files. Manrope is published upstream under a libre font licence, but that text has NOT been read from the files received or from upstream, and rule 8 forbids filling this from memory. Nothing is stated here until the text is read | UNKNOWN meanwhile, and treated exactly like the two commercial faces: the files are NOT in git (`.gitignore` -> `deck/fonts/`). This one is expected to resolve permissively once the text is read, which is why it is cheap to close: fetch the OFL text that ships with the upstream release, read it, and rewrite this row. Owed: whoever renders the deck next |
| Deck photography (`deck/assets/`, 25 JPEGs) | received 2026-08-22 in Ashrith's deck bundle | UNKNOWN. No source or licence accompanied them. They are the room, product and genre photographs the sales deck displays | Committed to this PRIVATE repo so three collaborators can render the deck, which is the whole reason the deck became a pipeline. That is not a licence finding: if any of these are stock under a restrictive licence they must be replaced before the deck is published anywhere public. Owed from Ashrith: where each set came from |
| pillow-heif (optional HEIC path in engine one) | not installed | UNKNOWN. Wraps libheif (LGPL-3.0) and HEVC decoding carries patent-pool questions no one here has read | UNKNOWN. Not needed for v1 scope (RAW + JPEG). Resolve before ever enabling HEIC in a shipped build |
| PyInstaller (build tool) | COPYING.txt read in full 2026-08-17 (pyinstaller/pyinstaller develop) | GPL-2.0-or-later for PyInstaller itself, with the Bootloader Exception: "unlimited permission to link or embed compiled bootloader and related files into combinations with other programs, and to distribute those combinations without any restriction coming from the use of those files". Bootloader + ./PyInstaller/loader are the exception-covered files; run-time hooks (./PyInstaller/hooks/rthooks) are Apache-2.0 | Yes. The only PyInstaller code that ships inside the packaged binary is the bootloader/loader (exception-covered) and rthooks (Apache-2.0), so the output binary carries no GPL obligation. PyInstaller as a build tool never ships otherwise. Condition: do not modify or redistribute PyInstaller itself outside GPL terms |
| pytest, pluggy, iniconfig, colorama, pygments, packaging | dev venv only | MIT/BSD family | Not applicable. Development tools; never ship inside the binary |
| scikit-image | 0.26.0 | BSD-3-Clause with BSD-2/MIT-licensed files (wheel metadata) | Not applicable. Test-fixture builder for engine one's suite only; never ships |
| piexif | 1.1.3 | MIT (wheel metadata) | Not applicable. Test-fixture builder for engine one's suite only; never ships |
| jsonschema | dev venv only | MIT (wheel metadata) | Not applicable. Validates RunResult against the wire schema in tests; never ships |
| PyYAML | LICENSE read from yaml/pyyaml main branch 2026-08-17, before install | MIT, copyright Ingy dot Net 2017-2021 and Kirill Simonov 2006-2016; grants use, copy, modify, distribute, sublicense, sell | Not applicable. Dev tool only: parses docs/relations.yaml and corpus/MANIFEST.yaml in tools/ and tests/; never ships inside the binary |
| exifread (CR3 parser candidate, W-A acceptance matrix) | 3.5.1 sdist `LICENSE` read in full 2026-08-20, before any install | BSD-3-Clause. Copyright (c) 2002-2007 Gene Cash; (c) 2007-2025 Ianaré Sévi and contributors. Source and binary redistribution permitted with the copyright notice, conditions and disclaimer retained; the authors' names may not be used to endorse derived products | Yes, on those conditions. NOT ADOPTED: the W-A matrix (recorded in HANDOFF.md) selected the in-repo `core/cr3.py` box parser, so exifread ships in nothing and is installed nowhere in this repository. Row retained as the read-before-install record for the evaluation |
| Python 3.12 runtime | 3.12.10 | PSF-2.0 | Yes. PSF licence permits commercial redistribution of the embedded runtime; retain the licence text. SHIPPED: `packaging/licences/python/LICENSE.txt` |

Rows the build plan requires before step 2: opencv-python-headless, numpy,
pillow, rawpy, LibRaw, YuNet. All six are filled and none says UNKNOWN.
PyInstaller was resolved 2026-08-17 (read before install, per the rule).
exifread was resolved 2026-08-20 the same way and then not adopted; the
CR3 parser accepted in W-A is in-repo code, so it adds no third-party row.
The one remaining UNKNOWN row (pillow-heif) gates nothing in v1 scope and
must be resolved before HEIC is ever enabled in a shipped build.

Shipping the texts (2026-08-22): every row marked SHIPPED above points at
its byte-for-byte copy under `packaging/licences/`, which both PyInstaller
specs bundle and the CI smoke asserts is present in the built output;
`tests/test_licence_texts.py` fails the gate if a SHIPPED path is missing.
`packaging/licences/README.md` records the SHA-256 of every copied file.
PyInstaller ships no text (bootloader exception, see its row) and the YuNet
model is not packaged, so its notice does not ship either. Two rows were
added that day from what the harvest showed inside the wheels: FFmpeg
(LGPL-2.1, text ships, source offer owed) and the Microsoft VC runtime
DLLs (UNKNOWN). Note that `pyproject.toml` does not pin these versions, so
a CI build resolves whatever pip offers that day; the texts describe the
versions read, and a drift there would need a fresh harvest.

Standing rule inherited from architecture A3: no personal head trains on any
embedding space until that space has a row here confirming it can ship inside
a paid binary.
